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We consider three broad classes of quantum secret sharing with and without eavesdropping and show how 
a graph state formalism unifies otherwise disparate quantum secret sharing models. In addition to the elegant 
unification provided by graph states, our approach provides a generalization of threshold classical secret sharing 
via insecure quantum channels beyond the current requirement of 100% collaboration by players to just a simple 
majority in the case of five players. Another innovation here is the introduction of embedded protocols within a 
larger graph state that serves as a one-way quantum information processing system. 



I. INTRODUCTION 

Secret sharing is one of the most important information- 
theoretically secure cryptographic protocols and is germane 
to online auctions, electronic voting, shared electronic bank- 
ing, and cooperative activation of bombs. Although first for- 
mulated and solved in classical information terms fit], two di- 
rections have been followed in the quantum case: classical se- 
cret sharing with quantum enhancement of channels to protect 
against eavesdropping 101 (and experimentally realized ^) 
and protecting quantum information as an application of quan- 
tum error correction (and experimentally realized in the 
'continuous variable' Gaussian state case lUt]). 

In secret sharing, a dealer wishes to transmit a secret, which 
can be a bit string or a qubit string and deals an encoded ver- 
sion of this secret to n players such that some subsets of play- 
ers can collaborate to reconstruct the secret and all other sub- 
sets are denied any information whatsoever about the secret. 
The access structure is the set of all subsets of players that can 
obtain the secret, and the adversary structure is the set of all 
subsets of players that are completely denied the secret. 

In threshold secret sharing, each player receives precisely 
one equal share of the encoded secret, and a threshold num- 
ber of any players k can collaborate to reconstruct the secret 
whereas every subset of fewer than k players is denied any 
information at all: this scheme is referred to as (/c, n) thresh- 
old secret sharing and is a primitive protocol by which any 
information-theoretic secret sharing protocol can be achieved. 

In each case the channel can be classical or quantum de- 
pending on context. A private channel is an authenticated 
channel that is impervious to eavesdropping. A public chan- 
nel is an authenticated channel that is open to eavesdropping. 
Mathematically channels are described by completely positive 
trace-preserving mappings, even for classical channels as clas- 
sical information processing can be embedded into a quantum 
framework. 

Our goals here are 

(i) to formulate a secret sharing problem that allows both 
classical and quantum channels, which can be private or 
public. 
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(ii) to introduce three subproblems that show how the orig- 
inal classical secret sharing and the two versions of 
quantum secret sharing fit into the general problem and 
highlight the differences between these subproblems, 

(iii) develop a graph state formalism |@1 that unites these 
subproblems into one elegant framework, 

(iv) extend one class of subproblems concerning classical 
secret sharing in insecure public channels beyond the 
existing security proofs that require 100% collaboration 
by the players, and 

(v) introduce embedded secret sharing protocols for graph 
states within one-way quantum computing, which could 
serve as a first step towards implementing integrated se- 
cret sharing protocols within quantum computing, e.g. 
distributed measurement-based quantum computation 
(MBQC) H. 



II. SECRET SHARING PROBLEM AND SUBPROBLEMS 

To begin we formulate the general problem. The basic unit 
of classical information is the bit, corresponding to {0, 1}, and 
the basic unit of quantum information is the qubit, correspond- 
ing to 7^2 = span{|0), |1)}. Any message can be encoded in 
a finite string of bits if the information is classical or in a fi- 
nite string of qubits (perhaps entangled and could be pure or 
mixed) if the 'information' is quantum. 

Secret Sharing Problem: A dealer holds a se- 
cret S, which is either a bit or a qubit, and must 
send this secret to n players such any k or more 
players can reconstruct the secret, and all sets of 
fewer than k players as well as eavesdroppers are 
denied any access whatsoever to the secret. 

Remark. A secret that is longer than one bit or one qubit can 
be shared by a distributed protocol that shares the string one 
bit or qubit at a time. 

Our new and general formulation of the secret sharing prob- 
lem is meant to be helpful in that it incorporates various sce- 
narios of secret sharing with quantum or classical channels 
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that can be public orprivate, and the three major secret shar- 
ing areas of study |lll|2l,l3] are subproblems of this overarching 
problem. 

CC Classical secret sharing with private channels between 
the dealer and each player and private Classical chan- 
nels shared between each pair of players; 

CQ Classical secret sharing with public channels between 
the dealer and each player and either Quantum or clas- 
sical channels shared between each pair of players 

QQ Quantum secret sharing wherein the dealer shares quan- 
tum channels with each player, and these channels 
can be private or public, and the players share either 
Quantum or classical private channels between each 
other 

As secret sharing is information-theoretically secure, the 
distribution of a classical secret message is completely se- 
cure without the need for quantum information, in contrast 
to quantum key distribution [8], which catapults key distri- 
bution over public channels to information-theoretic security 
from the classical limited computational-security guarantee. 
Thus case CC iH] is resolved fully by classical information 
processing, but we embed CC into a graph state description. 

Case CQ considers quantum-enhanced protection from 
eavesdropping over public channels and was first studied for 
(2, 2) threshold secret sharing iBIol floll and extended to (n, n) 
threshold secret sharing II 1 111 . The quantum enhancement is 
achieved by random key distribution enabled via quantum pu- 
rification. 

The third case QQ deals with the sharing of quantum infor- 
mation as opposed to classical information in the first two 
subproblems identified above. To distinguish this case from 
the first two cases, the term 'quantum state sharing' is some- 
times used f^. In contrast to CQ, which is only solved for 
the {n, n) threshold secret sharing case, this quantum infor- 
mation version in private channels is fully general in the sense 
that the general {k, n) case has been solved as an application 
of quantum error correction. 

In summary our graph state formalism unifies known re- 
sults concerning (n, n) CQ plus QQ for higher-dimensional 
stabilizer states, and adds new results, including (3, 5) CQ. 
We expect that our new approach to all forms of quantum se- 
cret sharing in the literature will enable further advances be- 
cause of the elegance and unifying properties of this formal- 
ism. 



III. GRAPH STATES 

Graph states provide a superb resource for secret sharing, 
as we show. The advantages of using graph states in this work 
are threefold. First, they are the most readily available multi- 
partite resource states in the laboratory at present, with graph 
states of up to 6 qubits akeady built and used for informa- 
tion processing experimentally (121 [l3ll , and many proposals 
for their implementation in various systems. Second, they are 
natural candidates for integration of different tasks, since they 



are the main state resource in almost all multipartite quantum 
information processing tasks, including measurement based 
quantum computation and error correction (hence the large ef- 
fort to make them). Third, they allow for an elegant graphical 
representation which offers an intuitive picture of information 
flow, and also allow the possible use of graph theoretic results 
to aid proofs and understanding. 

In this work we employ graph states in the standard form |0] 
plus two extensions. These extensions are actually quite sim- 
ple (modification via local unitaries) and are intended to al- 
low intuitive graphical understanding of how information is 
encoded and spread over the graphs. The idea is that the se- 
cret will be encoded onto classical labels placed on vertices of 
the graph representing local operations. The inherent entan- 
glement of the graph states allows these labels to be shifted 
around, allowing us to see graphically which sets of players 
can access the secrets and which cannot (explicitly written as 
properties P1-P4, see e.g. Fig.|2l). We will give several exam- 
ples along the way to make it clear. 

We will begin by defining these extended 'labeled' graph 
states in Subsec. IIII Al followed by describing the graphical 
rules of how they are used to spread information and how 
it can be accessed in Subsec. IIII B I finishing with how they 
change under measurements in Subsec. UlI CI 

A. Labeled graph states 

A pure graph state is a state in the Hilbert space 7i®", i.e. a 
string of n qubits. For|±) = (|0)±|l))/\/2 and an undirected 
graph G = (V, E) comprising n vertices, with 

V = {va, E = {ey = (v„v,)} (3.1) 

the set of n vertices and the set of edges, respectively. 

Definition 1. Two players i and j are 'neighbours' iff there 
exists an edge eij that connects their respective vertices 
and Mj. 

The set of i's neighbours is denoted Ni. 
A graph state is created from an initial state 

1+)®" = i?®" |0)®" , H = 1+) (0| + I-) (1| , (3.2) 

with H the Hadamard transformation, by applying the two- 
qubit controlled-phase gate 

CZ|ee') = (-1)"'|66'), 6,6' € {0,1}, |ee') G (3.3) 

to all pairs of qubits whose corresponding vertices on the 
graph are joined by an edge and not to any pair not connected 
by an edge. The commutativity of all CZ operations implies 
that the order of applying CZ gates is unimportant: 

|G) =[]CZe|+)®". (3.4) 

eeE 

We now modify the graph labeling. The usual graph state 
has each node labeled by its vertex index; in other words the 
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label of vertex is the index i, which has a bit string length 
of 0(log7T,). We append to this label three more bits so the 
label of vertex is (i, ^^1,^12,^13) for each £ij G {0, 1}. 

The first two labels are used to describe classical informa- 
tion spread over the state. Over all vertices, we define the vec- 
tors e,^, ^ {in, li2 ) for the vertex, 4^ = , , • ■ • , ^nj ) 
for the j* bit over all n vertices, and 



i — (^1* 5 ; ■ ■ ■ ; ^n* ) ■ 



(3.5) 



Graphically these labels will be attached to their vertices and 
used to represent the spreading of classical information. If a 
vertex v.; has no label, this is equivalent to setting iii, = (0, 0). 

The third additional bit occurs in the security of proto- 
cols, and is not relevant to the classical information transmit- 
ted. For the ease of graphical manipulation of the encoded 
information, we absorb this bit into the graph itself. Graphi- 
cally the third bit l.^ is depicted as the vertex v; being either 
a O (the set of which is denoted V°), for = 0, or a □ (the 
set of which is denoted V'-'), for £,3 = 1. The vertex set is 
thus a union of two types of vertices. 



V = V" u 



(3.6) 



We thus have the extended graphs Q = (V°, V'^, E). 

These extra labels imply the action of local unitary opera- 
tions (hence maintaining entanglement properties) via the fol- 
lowing definition. 

Definition 2. The 'labeled graph state ', is obtained f mm the 
graph state \G) by 



for 



■i 

\g)= (g) s,\Q) 

X=|0)(1| + |1)(0|, 
Z=|0)(0|-|1)(1|, 
5=|0>(0|-*|1)(1|. 



(3.7) 



(3.8) 



Remark. The partial phase shift gate S is used to perform 
an X Y basis transformation for protection against eaves- 
dropping, analogous to the BB84 strategy 



For encoding purposes, only local Z gates are required, so 
we introduce another kind of graph state. 

Definition 3. The 'encoded graph state ' is 

i 

Thus the encoded graph state is also a labeled graph state 
with = for all i, \g^J = |efc(o,,,,.o,^,,,...,o,£„.))- 
Encoded graph states exhibit the orthonormality property 



(3.10) 




FIG. 1: (Color online) Labeled graph with vertex vi, depicted 
as 1 inside a □, which indicates that 5 has been applied to this 
vertex, and vertices V2 and V3, depicted as the numerals 2 and 3 
inside O- The labels lii, = {la, £12) indicate that operation 
j)^*ii^*s2 have been applied to each qubit j, respectively. For 
lit, = (0, ^i2) Vz, this labeled graph state corresponds to the encoded 
state 15^-,) = Zf^' (S ^2""® Zl"'' {\0 + +) + i\l--))/V2 
(Eqn. i3A3[ ). 



Encoded graph states ) can be elegantly expressed in 
the stabilizer formalism. For Y ~ iXZ and stabilizer opera- 
tors for any vertex denoted by 



(3.11) 



(for circular and square vertices respectively) the encoded 
state \Q/ ) is completely specified by eigenequations 



(3.12) 



The following two examples, for three and for four qubits, 
respectively, explain how the stabilizers define the encoded 
graph states. 

Example 1. The three-qubit labeled graph state presented in 
Fig.\l\is the encoded graph state 



£3. n o + +) + ^|i--) 

x/2 



(3.13) 



and is the unique common eigenstate of 



^Yi ®Z2®Z-i 
K° =Zi ® X: 

^3 



2'i9 II3 
Zi<E)l2®X3, 



(3.14) 



with eigenvalues £^,2 = (^12, ^22, ^32)- 



A four-qubit encoded graph state is given in the fol- 
lowing example. First we define the n-qubit Greenberger- 
Horne-Zeilinger-Mermin (nGHZM) graph and corresponding 
nGHZM graph state. 
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Definition 4. The nGHZM graph /or vertex is the degree n 
graph 

GnGHZM = (V = {V,}, E = {(Vi, V,^,;)}) , (3-15) 

and the nGHZM graph state is the state corresponding to 

IGuCHZm)- 

Example 2. The AGHZM graph is depicted in Fig. \2][a), and 
the corresponding encoded AGHZM graph state is 

\g^~j (E) z^'^ (E) z^"-^ (g) z^''\g), (3.16) 
\Q) =^(|o + ++) + |i-— )), 

and is fully defined by the four stabilizers 

K°=X(g)Z(g)Z(g)Z, K° = Z(g)X(g)l(E)l, 

K2 =Z®]1®X®11,K2 = Z®ll®ll®X, (3.17) 

with eigenvalues ^2 = (^12, ^22, ^32, ^42)- 

B. Dependence and Access 

We first consider sharing a classical secret; sharing quan- 
tum secrets follows from this as we will see later Each qubit 
represented by a vertex in the graph is held by one player, and 
the classical secret is encoded into the label £*2- A subset of 
players is represented by a vertex subset V C V. 

For general labeled graph states, all accessible information 
for V resides in the reduced state obtained from the labeled 
graph state (13.71 ): 

Pv,f-Trv/v'|e,-)(%|. (3.18) 

In the context of secret sharing, it is important to know what 
information about (, is contained in py,^. The information 
shared between py,^and I exhibits two important properties: 

Al Bit dependence:- py,g- is dependent on bit k if py,^ is 
not invariant under a flip of the fc* bit. 

A2 Bit access:- Bit k is accessible if there exists a mea- 
surement protocol such that one copy of py,^ reveals 
the value of bit k with certainty. 

A2^A1, but A1^A2. Given dependency on a bit, it is espe- 
cially useful to know what information can be obtained by V 
via local operations and classical communication (LOCC) or 
via quantum channels. 

Graphically we ascertain the dependancy of a set of players 
V on the information by shuffling bits between neighbours: 
that is, exploiting equivalences between labeled graph states 
with different labels I. If a label does not occur on one of the 
vertices in the set V, that set has no dependency on it. This is 
obvious because the label would then represent a local unitary 
operation outside the set V, which cannot affect the reduced 
density matrix py,^. We thus look for equivalences between 
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(0,^22) (0,42) (42, £42) (0.f32®^23) (0: £42*^22) 

(b) (c) 

FIG. 2: (Color online) Equivalence of labeled graph states depict- 
ing bit dependence for four players, (a) The initial four party en- 
coded graph state corresponds to li-t, = (0,Zi2). (b) Equivalent 
state with/i* = (0,0), ^2, = (0,^22), /a* = (0,^32), and £1* = 
(^12,^42) (see Eqn. ( 13.19b ): bit ^12 has been shuffled from vertex 1 
to vertex 4, which is indicated by the arrow in the figure, (c) Equiv- 
alent state with bit £22 shuffled to the other parties: ^i, = (£22, ^12), 

£2, = (0,0), £3. = (0,^22 e ?32), and 4* = (0,/22 e «42) as 
indicated by arrows and labels (see Eqn. J3.20b ). NOTE: vertex 
without label is equivalent to setting £i* = (0, 0). 

labeled graph states where labels can be shuffled outside V' 
as much as possible. Of course different £v,2-labeled graph 
states, equivalently encoded graph states, must be inequivalent 
because of the orthonormality relation ( 13.10b ; indeed this is 
why we need the labels. 

Then the next step is to ascertain if the desired informa- 
tion can be accessed by V, which is effected by a measure- 
ment protocol corresponding to appropriate combinations of 
Ki ( 13.111 ), then exploiting the eigenequation relations ( 13.12b . 

Fortunately the graph readily reveals the appropriate way 
to do this. Before giving the general rules, we begin with a 
four-qubit example. 

Example 3. A dealer distributes the encoded graph 
state ( 13.761 ) to all four players V — {vi, V2, V3, V4} depicted 
in Fig.^a). In this example we show that, if the three players 
in V = {vi, V2, V3} collaborate, they learn two bits (-^22, ^32) 
of the four-bit encoding and are entirely denied knowledge 
of two other bits (^i2,^42)> whether they use shared quan- 
tum channels or only LOCC. We also see that just two players 
V" = {v2, V3} can (andean only) acquire £22ffi^32 via LOCC, 
where © is summation mod 2. 

Acting upon the encoded graph state ( 13.161 ) by the fourth 
stabilizer of Eq. ( 13.17b yields 

K2^^^\g^-j =ti®z'^^^® zl'^ ® xl'^zl^^ \g) 

= (-1)^-^-1^^-.^). (3.19) 

The player subset V = { Vi , V2 , V3 } is thus independent of £12 
because local unitary dependence on I12 has been shuffled to 
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player V4's two-bit label i^i,. In Fig.|2b), this £12 bit shuf- 
fle is depicted as a green arrow from vertex Vi to vertex V4. 
Vertex Vi is unlabeled because its bit value is now zero, and 
vertex V4 now has a two-bit label £4* = (£12, £42)- The graph 
states in Figs.|2ta) and|2b) are thus equivalent up to (an irrel- 
evant) global phase. 

Players in V share a reduced state that is dependent on 
bits £22,^32- In fact they can perform measurements corre- 
sponding to K2 and to learn these two bits according 
to ( |3.12t . With shared quantum channels, there is no prob- 
lem in performing such a joint measurement as A'^ and A'^ 
commute and have support only on operations by players in 
v. However quantum channels are not required: the players 
can learn {£22, £32) by LOCC because the stabilizers commute 
locally. In contradistinction a failure of local commutation 
would imply that these bits could not be learned by LOCC. 

In fact a smaller set of players can access information. Con- 
sider the set of players V" = {v2, V3}. Applying eigenopera- 



tor K 



0I2 



yields 



K 



22+^32 Ar> '7'£22-|-«42 



\Q) 



fc(«22,^12,0,0,0,«22©^32,0,^22e^42) 



^12^2 



(3.20) 



This implies that the reduced density matrix only depends on 
£22 ffi £32- This information can be accessed by measuring 



^ X® X ®t. 



(3.21) 



This can be done by LOCC. This shuffling is illustrated in 
Fig.|2tc); hence all graph states in Figs.|2a) to|2c) are equiv- 
alent. 

Remark. Stabilizer operators K!p ( and products thereof) are 
not directly measured by the players under LOCC; rather 
players locally measure in the Xi, Yi = iXiZi, or Zi bases to 
obtain one-bit outcomes sf, sj , and sf , respectively, where 
sf is assigned the value ;/ the measurement outcome is 1, 
and 1 if the measurement outcome is —1. 

Then the bit value outcome for the measurement of K2 
and in Example\3\is 



5?, £32 



4. 



(3.22) 



respectively. Henceforth when we say players can locally 
measure an operator, we mean measurement in the sense that 
local Pauli measurements can be performed and resultant bit 
outcomes combined to learn the same as if nonlocal stabilizer 
measurements were performed. 

For Example |3] each player's qubit corresponded to a O 
vertex. Extending to □ vertices is straightforward by using 
the A"P stabilizers ( 13. lit . Specifically if a vertex is modified 
by changing its graph representation from a O to a □, in the 
stabilizers an X is changed to a y and we have a correspond- 
ing change to the bit transfer. 



Example 4. For Examples^and^let the O representation of 
vertex Vi be changed to aO in Fig.\2][a). Thus, in Fig.^c), the 
resultant bit pair on vertex Vi is iii, = {£22, £12 ffi ^22) instead 
of £ii, ~ (£22, £12) because modifying X ^ Y = iXZ in 
the revised stabilizer ATP 1-^ ATf yields an extra Z operation 
leading to (Bl on the second bit (via the appropriate change 
to Eq, ( 15.201 )). The others remain the same £3* = (0, £2 ffi £3), 

4* = (0,4 ffi 4). 

These examples for four qubits are generalizable to n qubits 
with O or □ vertices. Here are the general principles for 
accessibility and dependence of information in an encoded 
graph state. 

Proposition 1. The following principles hold for encoded 
graphs states \Gjr J- 

PI The encoded graph state [Q^ ) with one-bit label li2 
on vertex is equivalent to the labeled graph state 
\Q^) where vertex is relabeled and a neighbour- 
ing vertex Vj is relabeled either £ji, — {£i2,£j2) or 
£j* = (£i2, ^2 ffi ^12), depending on whether vertex is 
of the type O or □, respectively. The remaining neigh- 
bours ofvj, Vfe G Ni are relabeled (0, £k2®£i2)- In this 
way any neighbour of Vi can shuffle the dependency of 
£i2 to itself and to its remaining neighbours. Bit shuf- 
fling is depicted as green arrows and shows how depen- 
dence of the reduced state on bit labels can be trans- 
ferred from one player to another 

P2 The bit value £12 is accessible by players in set V if and 
only if\Ji and all its neighbours Ni are in the set V. 

P3 If the set V comprises an even number of players, and 
all their external neighbours (outside the set V) are 
neighbours of each and every player in V, then the sum 
(mod 2) of all their one-bit labels {£12} is accessible, 
i.e. they can collaborate to find 

£i2®£j2-®£m2, Vi,Vj,...,V,„ G V. 

P4 IfP2 holds, and players in the set share quantum chan- 
nels, all information encoded in one-bit labels is acces- 
sible. If the set shares only classical channels, and P2 
holds, then information accessibility is limited because 
neighbours Vj and Vj in the set can only learn either £.12 
or £j2 but not both, but and \tj in the set can learn 
both £i2 and £j2 if they are not immediate neighbours. 

NOTE: The bit shuffling in PI is not active; rather it recog- 
nizes equivalence between labeled graph states. 

Proof. All proofs are simply derived from eigenequa- 
tions ( 13.111 1 and ( 13.121 ), which shuffles bits between play- 
ers, thereby revealing actual dependence of reduced states on 
given bit labels {£12]- 

For PI, suppose vertex has a neighbouring vertex \ij 
which is either a O or a □. Then 
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\QiJ H~iY'^'^^Kf'^^\QiJ = {-lY-^'^^t^ ® zf^xf- ®(v..v,)eE 4''=^+''^^ ®™^„-;(v,„,v,)^E zlr-\Q), 

\QiJ H~lf^-''^Rf''^\g,^J = i-lY^^''^^h « ®(v„v,)EE ®,..#^,;(v,„,v,)^E ^^"^1^?), (3.23) 



respectively. Evidently dependency on is shuffled from 
neighbour Vj to v^ , and Vj's other neighbours are as described 
in PI. 

For P2, players obtain ti2 by measuring A'P''^ of (13.11b 
and ( |3.12| i. Because K^' is nontrivial on i and also on Ni, 
by ( 13.1 11 1, player i and all of Ni must collaborate to mea- 
sure £i2, and this collaboration is sufficient. 

For P3 we start by looking at the case V' contains only two 
players. By (13.111 1 if all neighbours of pair Vi,Vj e V are 
either in the set, or shared outside the set, kP'^ ■ K^'^ is 
nontrivial only inside the set, and thus can be measured by the 
members of the set. This is true since all the Z from the K^'^ 
cancel with the Z from K'^'^ on their common neighbours. 

Applying A'°'° • K°'^ to ( I3.12l i, we see that this yields £,2 
£j2- Similarly this holds for any even number of players. 

For the comparison of LOCC to the fully quantum case 
of P4, by the above logic if properties P2 and P3 hold, then the 
dependency on the associated observables are nontrivial only 
within the set. As all operators A'p'^ commute, all observ- 
ables commute in the nontrivial set, and hence can be mea- 
sured by global operations. 

For LOCC, it is clear from (13.111 1 that, if vertices v, and Vj 
are neighbours, then K^'^ and K^'^ share different local 
Pauli operators on i and j hence cannot be simultaneously 
measured locally; therefore, even if P2 holds, one must choose 
one measurement or the other. If vertices v,; and Vj are not 
neighbours, they are indeed amenable to simultaneous local 
measurements. Similar statements can be made when P3 
holds, but are more complicated graphically and must be taken 
case by case. □ 



C. Local Z and Y measurements on encoded graph states 

In our protocols encoded graph states with both □ and O 
vertices arise as a result of performing either Y 01 Z mea- 
surements on qubits identified by vertices of the labeled graph 
with only circular vertices. Local Pauli measurements on 
graph states are described by a simple set of rules, which read- 
ily yield the resultant states These rules were originally 
stated in terms of graph states up to local unitary operations. 
For our purposes we would like to incorporate also these lo- 
cal unitary operations into the labeled graph states. We now 
represent these rules exactly graphically for the Z and Y mea- 
surements, using the labeled graphs above, with no local uni- 
tary ambiguity. 

If a Z measurement is made on vertex Vj of an encoded 
graph state with circular vertices, the resultant state corre- 
sponds to a labeled graph state of the original graph but with 




(0, £42) (0,%2) (0,42 ® in (D sf) 

tb) (b') 



FIG. 3: (Color online) When Pauli Z and Y measurements are made 
on vertex vi, graphs (a) and (b) metamorphose into (a') and (b'), 
respectively. Outcomes Sf — 0,1 coffespond to measurement 
eigenvalues —1, +1 respectively, and are incorporated into the labels 
in (a') and (b'). 

vertex and its edges deleted. For outcome sf , the labels of 
all vertices in Ni change to £j* 1-^ (0, £j2 ® sf). We denote 
the resultant graph by g. 

If a y measurement is made on vertex of an encoded 
graph state with circular vertices, the resultant state is a la- 
beled graph state obtained by applying the following four 
steps to the original graph; the new graph is denoted g'. 

51 Perform local complementation on Vi! all existing edges 
between elements in Ni are removed, and where they 
did not exist, they are added. 

52 Each O vertex in Ni is changed to □. 

53 For outcome sj , the labels on the neighbours of i 
change to £j^ = (0, £,2) (0, £j2 ® ^2 © sf ) 

54 Remove vertex i and all its edges. 

Example 5. A Z and a Y measurement on vertex Vi of a 
square graph state with circular vertices changes the graphs 
as depicted in Fig. \3\ 

These rules can easily be understood by the fact that any 
encoded graph state with labels £i2 — OVi can be written in 
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the form 

|5(0)) =^ (^|0)l|5(0--0)>2,...,n + |l)l|ff(l^^o---0))2,...,n^ 

ITT /4 / 

= ^(^|0')l|ff[o...o)>2.....n 

-*|l')i|g;i...io...o))2,...,«)' (3-24) 

with {|0), |1)} and 

{|0') = 1/V2(|0) - |1') = l/^/2(|0) + ^m 

the eigenstates of the Z and Y PauH operators, and the corre- 
sponding eigenvalues are +1 and —1, respectively. Adding la- 
bels ii,2 indicates the application of local Zs. This commutes 
with measuring Pauli Z, so the labels carry forward only with 
the addition of the correction from the measurement itself, e.g. 
Fig. [3a),(a'). However, local Z does not commute with a 
Y measurement, hence the bit £12 carries on to the measured 
graph (S3), e.g. Fig.[3l:b),(b'). 

The following definition follows naturally. 

Definition 5. Given a graph Q with only circular vertices, and 
associated encoded graph state \Qf^ ^, the graph of the state 
given by measuring Pauli Y on vertex i S {1, . . . ,n} is called 
the conjugate graph denoted g', with conjugate graph state de- 
noted \g')i....^n/i and can be found explicitly by following the 
rules 

Rl Perform local complementation on v^. 

R2 Replace all neighbours ofi with □ vertices. 

R3 Remove and all its edges. 

It can easily be shown that encoded conjugate graph states 
can be written as 

9{o-o) ) = ^ [\9{o-o)) + l3(l_^o...o)> j 

9[i . . . lo-o)) ^^71~ (iff(o-o)) - «l5(l_^o...o))) 

(3.25) 

so are effectively conjugate to the encoded graph states 
{|5(o---o)),l5(l...lo.--o)>}- 

The following definitions are useful for Sec. |V] 
Definition 6. The nGHZM graph GnCHZMi is embedded in Q 

ifGnCHZM, C g andNi n GXGnCHZM, = 0- 

Definition 7. The nGHZM graph state is embedded into state 
\G) ifQnCHZM^ is embedded in Q. 

We now have the necessary formalism to develop the vari- 
ous secret sharing protocols. 



IV. SECRET SHARING PROTOCOLS 

In this section we introduce our three secret sharing proto- 
cols beginning with CC for sharing classical secrets in Sub- 
sec. IIV A| Using our graph state approach, we construct solu- 
tions for each of (n, n), (3, 4) and (3, 5) threshold secret shar- 
ing. These results provide a foundation for our subsequent 
protocols: CQ in Subsec. UVBl and QQ in Subsec. UVCl 

A. CC 

In the CC protocol, classical information is directly en- 
coded into the bit string ^*2, i-S- onto the encoded graph 
state ^)} in a manner that enables certain sets of collab- 
orating players to access concealed information according to 
the principles of the secret sharing protocol. 

Mathematically our protocol is similar to Gottesman's ifTill 
wherein stabilizers are used to share classical secrets in quan- 
tum states. A difference between our scheme and Gottesman's 
is that he uses mixed high-dimensional states whereas our 
graph state approach enables use of pure states on qubits. An- 
other difference with Gottesman's approach is that our method 
is not as general: our scheme works for a limited number of 
{k, n) scenarios whereas Gottesman's method works for any 
{k,n). Although our scheme is more restrictive, it is appli- 
cable to a restricted set of cases and importantly provides a 
foundation for the protocols discussed in subsequent subsec- 
tions. 

The CC protocol steps are as follows: 

CCl The dealer encodes the secret bit string S into the clas- 
sical information and encodes this onto the n-qubit 
state 

CC2 The dealer sends each player one qubit. 

CC3 An authorized set of players accesses the secret bit by 
measuring appropriate stabilizer operators (prescribed 
explicitly in each case). 

Here we analyze the ability of sets of players to access this in- 
formation for two cases: using LOCC and using full quantum 
communication (FQC). We will see that each graph represents 
a different sharing structure, and that the rules of access are 
simple in graph terms, and show that some graphs can be used 
as secret sharing schemes as set out in the introduction. In 
particular we present schemes for [n, n), (3, 4) and (3, 5). 

We now proceed to give explicit examples of how the de- 
pendence and access properties in Sec. IIIIBI can be applied 
to give secret sharing via the above protocol. We begin by 
looking at the case of ??GHZMi states. Using Property PI, 
we can see in Fig. |4|a) that the player set {vi, . . . , v„i} de- 
pends only on bits ^22, • ■ • , ^m2\ i-c, the dependency on ti2 
has been removed. From P2 it is possible for the same player 
set to recover all ^22 • ■ • , ^m2, and, by P4, this can be done by 
LOCC. 

Explicitly this would be done by player 1 measuring Zi and 
the remaining players {v2, . . . , Vm} measuring and com- 
paring results to measure K2 , ■ ■ ■ , K^^, yielding £22, • ■ • , ^m2 
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FIG. 4: (Color online) Distribution and access of information 
{li2, ■ ■ ■ ,ln2} for the n-GHZM state. The green arrows represent 
uses of dependency Property Pi. In (a) the dependency on I12 is 
taken out of the set, and in (b) the dependency on I22 is shared across 
the whole set. This encoded graph state gives an (n, n) secret sharing 
scheme by setting I12 = S and the other bits can be set arbitrarily. 

via eigenequations ( I3.12l i. Hence, in this case, LOCC is suffi- 
cient for all possible information access. 

Similarly Fig. |4jb) shows how PI implies that the player 
subset {v2, . . . , Vm} depends on bits 

only and, by P3 and P4, they can be accessed simultaneously 
by LOCC alone. Explicitly this would be done by all players 
measuring Xi. The players in this set then compare results to 
measure 

K° ■ K^,K° ■ K2, ...K°- RO. (4.1) 

Only in the case that all players collaborate would there be 
a difference between the LOCC and FQ cases; in this case 
P4 implies that, by LOCC, the players can either access 
^22, • • • ,4i2 or £12- Obviously, for FQC, all information is 
simultaneously accessible. 

We see above that bit £12 is only accessible when all play- 
ers act together. By choosing the secret bit S* as S* = £12 and 
fixing all other £12 arbitrarily, we obtain the following propo- 
sition. 

Proposition 2. An encoded nGHZM state with £12 = S and 
all other £12 set to zero enables a (n, n) direct secret sharing 
scheme that can be accessed via LOCC. 

This case is depicted in Fig.|4] 

Now we see that (3, 4) threshold secret sharing is attainable 
with encoded graph states. 

Proposition 3. The A-qiibit ring encoded graph state with 
£12 = £22 = ^32 = ^42 = S enables a (3, 4) direct secret 
sharing scheme, and LOCC between players suffices for de- 
coding. 

Proof. The 4-qubit ring state is depicted in Fig. [5] We see in 
Fig.|5ja) that PI shows that pairs {vi,V2}, {v2,V3}, {v3,V4} 
and {vi , V4} are denied any information whatsoever. 

Figure |5]!b) shows that the player pair {vi, V3} can obtain, 
and moreover can only obtain, ^12 © £32- Similarly {v2, V4} 



obtain, and only obtain, £22 © ^42- Fig.|5tc) reveals that play- 
ers {vi, V2, V3} obtain, and only obtain, £22 and/or (by using 
FQC/LOCC) £12 © £32- 

Similarly, players {v2, V3, V4} obtain, and only obtain, £32 
and/or (via FQC/LOCC) £22 © ^42- The remaining triplets 
obtain, and only obtain, £12 and/or (via FQC/LOCC) £22 © 
£42 in the case of {vi,V2,V4}, and £42 and/or (FQC/LOCC) 
£12 © ^32 in the case of {vi, V3, V4}. 

We see that this graph gives a (3,4) threshold scheme by 
setting 

£42 = £22 = ^32 = 42 = S. (4.2) 

□ 

Our final result in this subsection concerns the (3, 5) thresh- 
old scheme, given by a 5-qubit ring depicted in Fig. |6] 

Proposition 4. The five-qubit encoded RING graph state en- 
ables (3, 5) threshold secret sharing for the CC protocol pro- 
vided that £12 = £22 = I32 = ^42 = £52 = -S*, with LOCC 
between players being sufficient for decoding. 

Proof. Fig. |6ta) shows how PI implies that players 1 and 2 
cannot access any information because the dependency can be 
taken away from them. Similarly it is easy to see that no pair 
of players can access any information by application of PI. 
On the other hand if three cyclic neighbours {vi,Vj, Vfe} form 
a set, PI implies the set only depends on £j2', this is clear 
from the case for the player set {vi, V2, V3} in Fig.|6jb). P2 
implies the bit can be accessed, and P4 says this access can 
be achieved via LOCC. Accessing would be accomplished by 
measuring which is done by locally measuring Zi, Xj, 
Zk- 

The remaining possible sets of three players are all similar 
to the T shape in Fig. |6|c); in this case the set {vi,Vj, v^} 
depends only on £i2®£j2(B£k2 by property PI. This is seen for 
the example {vi, V2, V4} in Fig.|6jc). By properties P2 and P4 
the players can access the secret by LOCC. Their procedure is 
effected by measuring ■ ■ K'j^, which is accomplished 
locally by measuring F,, Yj, X^. 

Any set of more than three players contains at least one of 
these possibilities, and the players can therefore access the 
same information. By choosing to encode the bit secret S as 

h2 = ^2 = ^2 = ^4 = 42 = S, (4.3) 

the proposition is proved. □ 

Here we established three examples that use graph states 
for secret sharing. These three examples demonstrate the sim- 
ple properties of our approach, and more examples of graph 
states for secret sharing could be found. In the next two sub- 
sections, we extend these results and techniques to secret key 
distillation and to sharing a quantum secret. 

B. CQ 

In this subsection we address case CQ, which corresponds 
to the protocol expounded by Hillery, Buzek, and Berthiaume 
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FIG. 5: (Color online) Application of PI to the square encoded graph state. This graph gives a (3,4) secret sharing scheme setting 
l\ = l2 =(■■!,= t4, = S (see proposition[3j- 






FIG. 6: (Color online) Application of PI to the 5-qubit ring encoded graph state to obtain a (3, 5) direct secret sharing scheme by setting 

ei2 = I22 = £32 = £42 = I52 = s. 



(HBB) for sending a classical secret with insecure quantum 
channels between the dealer and players 10] ■ Actually this 
problem can instead be solved by combining the classical se- 
cret sharing protocol of Shamir ^ via standard quantum key 
distribution (QKD) \S\ to assure secure classical channels be- 
tween the dealer and each of the players. In the QKD ap- 
proach, the dealer would first establish a random key with 
each of the players individually by using QKD. This would 
enable perfectly secure classical communication between the 
dealer and each player (as a one time pad), which can then be 
used to perform the Shamir protocol safely. However, QKD 
may not afford the most efficient approach hence the interest 
in alternative schemes. 

HBB |l2tl combine secret sharing protocols with QKD: the 
dealer distributes multipartite states to share a secret key, 
which can only be distilled by or shared with authorized sets 
of players. This key can then be used to send any classical 
message the dealer would wish to send to the authorized play- 
ers, without any unauthorized parties having access to it. The 
HBB approach can be more efficient in the number of uses of 
quantum channels between dealer and players, which is com- 
parable to the greater efficiency achieved by direct distillation 
of multipartite entanglement rather than distillation of pairs 
of maximally entangled states and complicated sequences of 
teleportations ifTsIl ). 

Another benefit is that the HBB approach can be extended 
to sharing quantum secrets (QQ) as we see in the next subsec- 
tion. HBB [2J created a classical threshold scheme for (2, 2) 



and (3, 3) cases, and this has been extended to the (n, n) case 
in fljl]. 

We note that, as an extension of HBB, our protocol shares 
the same drawbacks. The HBB protocol, hence ours, protects 
against intercept-resend attacks but is not guaranteed to be se- 
cure against other attacks 1^. Second, it only works for a 
noiseless channel: In the case of a noisy channel, the HBB 
protocol can not establish a key (as the noise will be mis- 
taken for an eavesdropper). This problem is likely not fatal, as 
approaches involving entanglement distillation or alternatives 
could help to overcome the effects of noise in the channel ifioll . 

Our protocol employs graph states to generalize the HBB 
scheme 101. By using graph states our scheme could build on 
current experimental research for generating graph states for 
measurement-based quantum computing |12]. Further, encod- 
ing onto graph states allows us to use the properties developed 
Sec.|III]to generalize to other access structures. 

As an example we show how this approach generalizes 
HBB's protocol to the (3, 5) case, together with the (n, n) 
case. Although other examples are not provided here, the 
properties given in Sec. lIIIBl allow further exploration. In ad- 
dition, our graph state shows how the HBB protocol can be 
thought of as an extension to Gottesman's results [[Till , in the 
sense that HBB's protocol can be regarded as a purification of 
Gottesman's. 

The underlying concept for the protocol is simple. We use 
an entangled state as the channel between the dealer D and n 
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players. This will be a graph state; hence we can always write 
in the following way (c.f. Sec. 1111 CT l 

\G{0)) =^(|0>i?l.9(0-0))l,...,n 

+ |l)D|ff(l_^o-0))l,-.") 
gi7r/4 , 

= -^(|0%|5(0-0)>l,-,« 

-*ii%i5;i...io...o))i,-.")- ^^-^^ 

The dealer measures randomly in either the {|0)d, |1) d} or 
the {|0')£i, basis. The dealer's measurement outcomes 

provide the random key. 

Through the entanglement, the players can access the key 
by making the correct measurement. If the dealer measures in 
{|0) D, |1)d}, the results are then correlated to the states 

{l5(0---0))l,...,ni |5(1 . . . io...o))i. ■■■,"} 

held by the players. If any set of players can discriminate 
these states perfectly, they can find out what the measurement 
result of the dealer was, and thereby obtain the random key. 

The dealer may instead choose to measure in 
the {|0')£), jl')/?} basis, and then the player's qubits 
will end up in either of the associated conjugate states 

{\9[o. ..0))l,....n, |5'(1 . . . lo...Q))l,...,n} 

correlated to the measurement result. The ability to discrim- 
inate (or in other words, to access the information £^,2 and 
hence get the key) is then determined by the conjugate graph 
g', which must be checked to have the correct access struc- 
ture also (if we want to do secret sharing). We see that this 
works for the GHZ and the 5-qubit ring encoded graph states, 
but it does not work for the 4-qubit ring encoded graph state. 
This is why we cannot extend the (3, 4) CC protocol to key 
distribution in this way. 

In the case of only one player, this corresponds to Ek- 
ert's protocol |[l6ll . In our case there is the added struc- 
ture given by the graph g. Discriminating these states is 
the same as accessing either the information £i,2 = or 
£,^2 = (1, . . . , 1, 0, . . . , 0). By choosing the right graph, only 
the authorized players can access the information, or discrimi- 
nate the states and access this key. In this first instance we use 
exactly the graphs of the last protocols to do this. In this way 
these entangled states (I4.4l i are a purification of the protocols 
of the last section - taking a random choice of the two graph 
states (which can be viewed as a mixed state) to an entangled 
pure state by adding an auxiliary system, which is the dealer 
in this case. 

The players also measure randomly to either discriminate 
states 



{|5(0---0)) !,...,«, |5(1^^^0---0))l>---^n}' 

or the conjugate states 

{|5(0---0))l, ■■■,«' \9[l . . . lo...o)>l,...,n}■ 
€ND 

As seen in Sec. 1111 CI these states are conjugate in the sense 
that discriminating the states 

{|5(0--0))l,...,n, |5(1 . . . lo--o))i>---."} 

provides no information about whether we have 
l5(o---o))i,---," 

or 




Thus, the players cannot discriminate both bases simultane- 
ously, so even if a set of players is authorized and can discrim- 
inate perfectly, 50% of the time they will measure in a basis 
in which they gain no information about the dealer's measure- 
ment result, hence will not access the key. To accommodate 
this at some point in the protocol, the dealer or players must 
announce which basis they measure. Results where the bases 
match are kept, and those that do not match are discarded. The 
remaining results should be perfectly correlated and provide a 
random key, often referred to as the 'sifted key'. By standard 
classical security protocols this can be distilled to a secret 
key by the dealer and authorised players sacrificing part of the 
sifted key. 

In this way our protocols are protected against a large class 
of attacks, namely the so-called intercept-resend attacks. For 
such attacks we imagine an eavesdropper (traditionally called 
Eve) who tries to gain information about the secret key by in- 
tercepting the qubits before they reach the players, and either 
measuring them directly or entangling them to some ancilla 
'spy' -qubits of her own and then sending them on to the play- 
ers. (In fact, this eavesdropper could instead be some unautho- 
rized players.) At any point in the protocol Eve may measure 
her entangled ancilla spy-qubits to attempt access to the key. 
She will try to do this in a way that is not detectable by the 
dealer and authorized players. 

Measuring in two conjugate bases serves two complemen- 
tary purposes to counter this particular class of attacks. First 
the measurements in conjugate bases is decided randomly, 
which protects against any intercept-resend eavesdropping 
strategy: if Eve knows which measurement the players will 
make, she can make the same measurement herself and thus 
be undetected, but, if she does not know the measurement ba- 
sis, then any intrusion by her will affect the statistics of sub- 
sequent measurements and thus be detectable. Second, mea- 
surement in conjugate bases allows checking of correlations 
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(b) 



FIG. 7: (Color online) CQ for (n,n). The dealer's qubit is attached so 
as to encode on the first qubit in the (n, ?i) scheme. As Eqs. J3.24t 
and i4.5\ indicate, if the authority measures the control qubit in X the 
resulting graphs are those of Fig. [4] In the case of Y measurements, 
the graphs transform to the right graph (b) (see text for explanation). 



to verify that the global state indeed corresponds to the cor- 
rect form ( 13.24b . which proves that Eve has not entangled the 
state to ancilla during its transit. 

If the measurements are truly random, we can view them as 
a kind of tomography of the state shared between the dealer 
and players, and suppose that all results represent this state 
faithfully. In fact these two purposes are not independent and 
are related to the long history of using entanglement distilla- 
tion to prove security for key distribution (e.g. jH). In both 
cases, the appropriate measurements are the stabiUsers of the 
state. 

Our protocol runs as follows 

CQl the dealer first prepares the state |.9(o-o))i...ri associated 
to the corresponding CC secret sharing protocol, then 
entangles extra qubits (known as the dealer's qubits) 
to each of the qubits upon which the secret is indepen- 
dently distributed (see Figs.|7^) and[8^)). 

CQ2 The dealer distributes to the players their qubits (and 
keeps the dealer's qubits). 

CQ3 The dealer and the set of authorized players V measure 
randomly one of a set of conjugate bases on their qubits 
and announce they have measured on a public classical 
channel. 

CQ4 The set of players V trying to access the secret an- 
nounce their measurement basis. 

CQ5 The dealer announces her measurement basis. 

CQ6 Classical security protocols follow estabUshing a secret 
key between dealer and authorized set of players. 

CQ7 The secret key is used to send the secret message. 

Now we see how this works for the (n, n) case. The state 
prepared by the dealer is that of the riGHZM state with an ex- 
tra vertex attached to player I's qubit (CQl); this extra vertex 
corresponds to a qubit that is retained by the dealer as shown 



inFig.lIta). 

|5(0))-D-1 n =(|0)D|ff(O---O))l,...,n 

+ |l)i?l5(io...o))i,...,n)/\/2 
=(|0%|.9(o...o))i,...," 

-*|l%l5(io...o)>i n)/^/2• (4.5) 

The stabilizers for state ( |4.5l l are 

K° =Xd «) ^1 12 «> Us ■ ■ ■ «> !«, 
K° =Zd «) (g) Z2 (g) Z3 • • • (K) Zn, 

/i'^ =]1d (g (g X2 «) II3 ■ ■ ■ «) In, 
if^ =1d (g ^1 (g ]l2 «> ^3 ■ ■ ■ 11„, 

=]1d(8)Zi® ]l2«)]l3---«)^«. (4.6) 

The qubit corresponding to vertex D is retained by the the 
dealer, and the others qubits are sent to the players (CQ2). 
As prescribed by the protocol, the dealer measures in the Z 
basis {|0)z3, |l)r,} or in the Y basis {|0')d, |l')r,}, and 
the players perform appropriate measurements to distinguish 

\9{0---0) / l,...,n 

from 1.9(10.. .o))i,...,n, or |g[Q...o))i,...,n from 
15(10 0)) I - "' respectively. Our arguments from the CC case 
show that discriminating |5(o...o))i,...,n from |5(io-..o))i,...,« 
cannot be done by a subset of fewer than ?? players. 

Similarly, we can apply properties P1-P4 from Sec. IIIIBI 
to the conjugate graphs as shown in Fig. |2lb), to see that 
the same holds trying to discriminate [^(o-. o))!' --." from 
l-9(io - o))i- - '"' players have various choices of how to 
perform both sets of discriminating measurements. Impor- 
tantly, the measurements for g will be conjugate to those for 

g'- 

We choose the following measurement strategy. The dealer 
chooses Zb or Yd randomly, player one chooses Xi or Yi 
randomly and the other players choose Zi or Yi randomly. We 
will see that 50% of the time their measurements will coincide 
to allow a shared key. That is, on half of the cases the ran- 
domly chosen combination will be equivalent to performing a 
suitable stabilzer measurement for which the dealer and play- 
ers will share a perfect key, and also be able to check statistics 
for security (CQ3). After the announcements of the measure- 
ment bases, the dealer and the players can discard any results 
where the bases do not match and are left with the sifted key 
(CQ4,5). 

To see this, first suppose that the dealer measures in the Zu 
basis. The players can then obtain a secret key (i.e. discrim- 
inate 1.9(0. ..o))i,...,n from |5(io - o))i,...,n) by measuring any 
combination of a product of stabilizers for the subgraph 9 as 
long as they include that of player I's vertex, which we de- 
note fc° (with lowercase for k indicating a stabilizer for the 
subgraph rather than the graph). 

As we can see by comparing the global state's stabiliz- 
ers ( 14.6b and the stabilizers of the subgraph (which can be 
imagined by extending those of Eq. ( 13.17b to n parties), in- 
cluding the Zd measurement of the dealer, the dealer plus 
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the players are effectively measuring i^P or any combina- 
tion of the total graph's stabilizers, including A'p such as 
i^P • ■ ■ ■ . Such stabilizer products corresponds to 
local measurements where player 1 measures Xi and the re- 
maining players measure Zi or Yi with an even number of 
those who measure Yi; or player 1 measures Yi and the re- 
maining players measure Zi or Yi with an odd number mea- 
suring Yi. 

Similarly, if the dealer measures in the Yd basis, the play- 
ers can obtain a secret key by measuring the stabilizers of 
the conjugate graph depicted in Fig. |2lb), or any prod- 
uct including this stabilizer: fc^ • /c^ • • • fc° (discriminating 
l5(o...o))i,- -.n from |g(io...o))i,. ..,„). Including the measure- 
ment by the dealer in the Y basis, this set of measurements 
corresponds to the dealer plus the players measuring stabiliz- 
ers • K'^^ or any combination of the graph's stabilizers 
including K% ■ K^, such as K° ■ ■ K° ■■■K°. This 
set of stabilizer measurements corresponds to local measure- 
ments where player 1 measures Xi and the remaining players 
measure Zi or Yi, as long as there is an odd number of those 
who measure Yi, or where player 1 measures Yi and the re- 
maining players measure Zi or Yi with an even number of 
those who measure Yi. 

Thus each combination of measurements Xi or Yi by 
player one, and Zi or Yi by the other players corresponds 
to the correct measurement to discriminate the appropriate 
encoded graph states either for the dealer measuring Zq or 
Yd. The dealer chooses randomly so, 50% of the time the 
measurements will coincide and results be correlated. After 
checking the bases match they throw away the cases they don't 
to give a sifted key. 

As discussed above, the randomness of the measurement 
bases ensures that any eavesdropper cannot know which mea- 
surement to make, and so any interference she introduces will 
be noticed by standard security checks (step CQ4,5,6) of the 
protocol. In this case, the dealer and authorized players should 
randomly choose a part of the sifted key (for example the 
dealer picks randomly and announces to all the players), and 
both the dealer and the authorized players announce their re- 
sults. 

They can then check that the results match those expected. 
If they do, they are sure there has been no eavesdropper, and 
that the key is secure. If the correlations do not match, they are 
forced to throw away the key and start again. As in HBB |2j] 
the players announce their measurement results (CQ4) before 
the dealer (CQ5) to prevent the players from cheating. 

That matching results imply security is evident from the 
fact that the random measurements can be seen as checking 
the state as mentioned above. In this case, if measurements are 
made randomly as described, each choice measures a different 
set of stabilizers. Doing this asymptotically builds statistics 
that give the expectation of all the stabilizer operators. If we 
obtain the expected results, i.e. that the state is a +1 eigenstate 
of operators • • • K'^ in ( I4.6l l, then the state is by definition 
that of ( 14.51 ) and hence not entangled to any possible eaves- 
dropper so an eavesdropper is denied any information about 
the key. We thus have the following proposition. 

Proposition 5. The CC (n, n) scheme can be extended as 



above to give secure distribution of shared random keys with 
the same secrecy access structure. The secret key can be ac- 
cessed by LOCC. 

Let us now see how the (3, 5) can be extended to a secret 
key distribution protocol. In this case, the state prepared by 
the dealer is that of Fig.[8ja): 

1^(0) ) m2345 = ( 1 0) £) 15(00000) ) 12345 

+ |l)r>l.9(lllll)>12345)/V2 
= (|0')-D 15(00000)) 12345 

-*|1%|5(11111)>12345)/V2. (4.7) 

The stabilizers of this total state are 

K% =Xd ® Zi® Z2® Z-i® Zi® Z5, 
K° =Zd ®Xi® Z2®t^®li® Z5, 
K"^ =Zd ®Zi®X2®Z'i®li® I5, 
K2 =Zd ®ti®Z2®X:>,®Z4^® 15, 
K2 =Zd ®ti®t2® Z-i® Xi® Z5, 
K2 =Zd® Zi®t2®'^3® Zi® X^. (4.8) 

As before, when the dealer measures in the Z basis, the fact 
that the graph 5 is a (3, 5) direct threshold scheme means that 
any pair of players cannot reveal the dealer's results, hence 
cannot access the key; in contrast any three collaborating play- 
ers can reveal the key. As the conjugate g' graph given by the 
dealer measuring in the Y basis (see Fig. lUb)) IS just a re- 
ordering of the original ring and replacing O ^ □ vertices, it 
is also a (3, 5) direct thresold scheme, so the same conclusions 
hold. 

Consider first the subset {vi,V2,V3}: as the dealer mea- 
sures Zd, the players' appropriate measurements correspond 
to the direct (3, 5) protocol of the previous subsection. That 
is, player 1 measures Zi, player 2 measures X2, and player 3 
measures Z3. This protocol corresponds to players measur- 
ing stabilizer fc^ of the induced subgraph (which is the ring 
of Fig. |6l), or the dealer plus the players measuring K° of the 
total graph (Fig.[8ja)). If the dealer measures Yd, the players' 
appropriate measurements correspond to the direct (3, 5) pro- 
tocol of the previous section, but changed slightly for the fact 
that it is the conjugate graph. 

By applying the properties of Sec. lIIIBl we can see this can 
be done by player 1 measuring Xi, player 2 measuring Y2, 
and player 3 measuring X^. This corresponds to measuring 
stabilizer ■ ■ k^ of the induced conjugate graph, which 
is the ring of Fig.[8jb), or the dealer plus the players measuring 
K% ■ K° ■ K° -K^ of the total graph shown in Fig. Eta)). 

We then have the dealer randomly measuring Zd or Yd, 
and the players randomly measuring in Zi, X2, Z3 or Xi, I2, 
X^. As before, they communicate to get the sifted key first 
(steps CQ4 and CQ5) in the protocol), and then follow the 
security steps after that. 

To observe that the protocol is secure, we study what these 
measurements imply about the total state of the dealer and the 
players {vi, V2, V3}. In step CQ5 of the protocol, some of the 
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sifted key is sacrificed to verify that the measurement results 
are those we expected, and if not we throw the key away. If 
the expectation value of iC^ is +1, and of K% ■ K"^ ■ K"^ ■ 
is also +1, as can be verified by the players, this means that 
the state of {vd, vi, V2, V3} is in the subspace of graph states 

{|5(0000))-D123> \9{1W0))d123, \9{W01)) D123, |5(0101))d123} i 

of the subgraph {v£),Vi,V2,V3}givenby erasing all other ver- 
tices and edges. This also means that there are no correlations 
between the dealer and any possible eavesdropper. This can 
be seen as follows. 

Given the established subspace, any global state of 
{v/), vi, V2, V3} and the environment E (which may include 
any eavesdropper) can be written 

"|0)£;|g(oooo))-Di23 + /5|l)£;|5(iioo))r>i23 
+ '5|2)£;|g(iooi))-Di23 + 7|3)_E|5(oioi))ni23- 

(4.9) 

The reduced density matrix of the environment and the dealer 
can be easily calculated, using Eq. (13.24b . thereby giving 

PE<E)i/2D, (4.10) 

where pE is the reduced density matrix of the environment. 
Thus we see that the mutual information between the environ- 
ment and the dealer is zero; hence any environment, including 
a possible eavesdropper, can have no information about the 
key. 

Now consider players {vi, V3, V4}. If the dealer measures 
Zd, the direct (3, 5) protocol tells us that the players should 
measure Xi, Y3, Y4, which corresponds to the players measur- 
ing the stabilizer product ■ ■ of the subgraph (Fig.|6]l, 
or the dealer plus the players measuring K'^ ■ ■ of 
the total graph Fig.[8ja). If the dealer measures in the Yd ba- 
sis, by considering the discrimination of the conjugate graph 
states Fig.lSlb), the players should measure Yi, Z3, Z4. Such 
a measurement protocol corresponds to measuring the stabi- 
lizer fcf of the conjugate graph Fig. [HJb), for the dealer plus 
the players measuring /v^ • A'P of the total graph Fig.|8ja). 

Again the players and the dealer should follow steps CQ4 
and CQ5 to obtain the sifted key and then compare some re- 
sults for the security analysis in step CQ6. If the expectation 
value of K° ■ K° is +1, and of K° ■ K° ■ is +1, the state 
of {vd, vi, V3, V4} is in the subspace 

{|5(0000))-D134, |3(0011))-D134, |3(1110))-D134, |.9(1101))r'134} 

of the subgraph {vd, ^1,^3,^4} given by erasing all other ver- 
tices and edges. Again, any state between the environment and 
the dealer and players {vi,V3,V4}, which has support only 
in this subspace, necessarily has no correlations between the 
dealer and the environment. Thus again the environment can 
not get any information about the secret key. 

Any set of three players can be covered by these two cases, 
simply by relabeling the players. We thus have the following 
proposition. 




(a) (b) (Q:s^) 

FIG. 8: (Color online) CQ for (3, 5). The dealer's qubit is attached 
so as to encode on all five qubits correlated for the (3, 5) scheme. As 
Eq. ( I4.7t indicates, if the dealer measures her qubit in X the resulting 
graph is that of Fig.|6ja). In the case of Y measurements the graph 
transform to the right graph (b). 

Proposition 6. The CC (3, 5) scheme can be extended as 
above to give secure distribution of shared random keys with 
the same secrecy access structure. The secret key can be ac- 
cessed by LOCC. 

Remark. As it stands, this protocol is not resilient to noise. 
Since noise (for example in the channel between the dealer 
and players) could interfere with the results of the measure- 
ment results in the sifted key, any noise would be seen as a po- 
tential eavesdropper and so the sifted key would be discarded. 
In fact this is a problem of the original HBB protocol also, and 
was resolved in by relating the problem to the distillation 
of the initial entangled state between the dealer and the play- 
ers. We expect that the same approach would work for our 
generalized protocol. In the case of (n, n) this seems a simple 
extension. However, for the (3, 5) case and possible further 
graph state bases secret sharing schemes, it would be more 
subtle and the distillation would be to subspaces with guaran- 
teed security rather than to specific states, reflecting the more 
complicated security analysis. The large body of work on dis- 
tilling graph states should prove very useful to this aim ( see 
for example ^ and references therein). This is a topic of 
ongoing work. 

C. QQ 

We now see how one more extension can be made to allow 
for the sharing of quantum secrets. Here we are addressing 
the third scenario presented in the introduction QQ, namely 
sending a quantum secret in the possible presence of an eaves- 
dropper. Our approach will be to use the same entangled state 
as for the key distribution protocol to teleport the secret quan- 
tum state across from the dealer to the set of players, where 
the structure of the graph will again imply the secrecy struc- 
ture. This teleportation extension is also that used in but 
here we extend it to general graph state protocols and explic- 
itly show it for the n) and the (3, 5) threshold schemes. 

Although we do not present as general a result as those 
in |4], where any {k,n) scheme is shown to be possible, 
our graph state cases are nevertheless interesting for several 
reasons. First, they represent a unification of secret sharing 
schemes of |0, B 13 via the graph state formalism, second 
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they use only qubits rather than higher dimensional systems 
as in |4||, which has advantages in that they are more easily 
implementable at present. Third the schemes here are explic- 
itly written and easy to understand and finally they are written 
in terms of graph states which are of particular practical inter- 
est across quantum information and will be extendible to the 
embedded protocols of the next section. 

Here we should note that because we are sending a quan- 
tum secret (that is, a secret quantum state), all players cannot 
simultaneously obtain the secret if only one is provided, since 
this would violate no-cloning We say a set of players can 
access the secret if it sits coherently within the space of their 
qubits, in a way they know. In this way with access to full 
quantum channels it can be localised to wherever they choose. 

In the case of only classical channels between the players, 
it may not be possible to localise information at all, and if it 
is we must choose a site to which they will localise the secret. 
In each case we discuss where it can be localised if possible 
by LOCC only. 

The protocol operates as follows 

QQl The dealer prepares a secrecy graph state as in the CQ 
key distribution protocol. 

QQ2 The dealer performs a Bell measurement on the qubit 



D and her input secret qubit \S)in, and performs the 
appropriate correction operation. 

QQ3 The dealer distributes to the players their qubits. 

QQ4 Authorised sets of players access the secret by mak- 
ing prescribed measurements and corrections to focus 
down the information to one of the authorized parties. 
This may require global operations by authorized play- 
ers (requiring quantum channels). 

Let us see how this works. After step QQl the dealer pos- 
sesses the encoded graph state \G(ji))D.i n and the input 

quantum secret |5)in = Q!|0)i„ + /3|l)in. We can see what 
the resultant state of the players will be after step QQ2 by 
rewritting the state in the Bell basis 

|Soo) :=(|00) + |ll))/\/2, 
liJoi) :=(|00) - |ll))/x/2, 
IBio) :=(|01) + |10))/x/2, 

:=(|01) - |10))/V2, (4.11) 

as follows. 



\S)in\Q{Q))DS,...,n =l/4(|-Boo)in,_D(Q!|5(o...O))l,...,n + /?l.9(l • • • 1 O- ■ -0) ) 1^ • • 
+ |Soi>m,I5(a|ff(0---0))l,...,n " I3\g(i . . . 1 o-.-O)) I,---," 
+ |^10)in,D(Q;|ff(l ... 1 o...O))l,-." + /^l5(0---0))l,...,n 

+ |5ii)in,D(a|ff(l ... 1 o...o))i.---." ~ /5|5(o.--o))i,. ..,«)• (4.12) 

I 



This can be seen using Eq. (13.24b . After obtaining result Bij 
corresponding to Bell state \Bij), the correction operator 

C/(«,j)i,...,n := ®a^N^Zl ■ K%^, (4.13) 
brings the resultant state to the desired encoded secret state 
\Sg) = a|5(o-o))i,...,« + • • . io...o)>i^-."- (4.14) 

In fact. Eg. (14.141 1 is analogous to the direct encoding ap- 
proach of 10, where a state is encoded directly onto a 
stabilizer space, or codespace. Again is more general 

than ours in that it covers all (fc, n), but again our scheme has 
the advantage of being set on qubits and explicilty and simply 
written down (where as in llil lTill it is done with high dimen- 
sional stabilizer codes via error correction codes and is not 
readily understandable in terms of states). 



From Eq. ( 14.141 ). it is clear that our dependency property 
(c.f. Sec. 1111 BT ) can be used to show whether subsets of users 
have any dependence on the secret qubit | S) (if the two graph 
states in the equation are identical for some set of users, ob- 
viously there is no chance they could extract the quantum se- 
cret). However, the access properties now fails, and we have 
to check if the subset of players can access the quantum secret. 
In other words, we have to check whether the quantum secret 
state is coherently placed within the reduced density matrix, 
and if it is, whether it can be localised by LOCC. 

This illustrates the difference between sharing classical and 
quantum secrets as discussed in detail in Iil4i1. Although we 
do not have a general method at present to decide when a 
quantum secret can be extracted also, for the (n, n) and (3, 5) 
threshold schemes we can see that the access structure remains 
the same. For a more general approach, links to the flow con- 
ditions for determinism in measurement based quantum com- 
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putation iHtIi seem very useful, as we see in our example be- 
low. We leave this to later work and for now concentrate on 
these two examples. 

In the (n, n) case the initial state prepared by the dealer 
is the same as that for the key distilation protocol, shown in 
Fig. Ha). After the teleportation steps QQ2 and QQ3, the 
players share the state 

\Sg)i....,„ = a|5(o---o))i,....n + /3|5(io---o))i,...,n, (4.15) 

encoding the quantum secret. The fact that any set of n — 1 
players has no dependency on the secret follows from the 
dependency property from Sec. 1111 Bl applied to the graph g, 
which, as in the case of the key distribution protocol, means 
the states Ig^Qj) and |.g(io - o)) appear locally identical to any 
such set, and thus implies they cannot read the secret. 

On the other hand by teleportation the secret state is coher- 
ently shared by all players, hence if acting all together, the 



players can access the secret perfectly, and can certainly lo- 
calise it to any chosen player by using quantum channels. If 
restricted to LOCC, they can in fact, also localise the secret 
onto any player First we consider localising it to any player 
other than player 1 . We can see this explicitly if rewrite the 
corresponding state (14.14b using ( 13.24b in the following way 

|<S'g)l,...,n =a|.9(0---0))l,...,ri + /3|.9(10---0))l,...,n 

= \9{0■■■0))l,....n/^H0)^+m^) (4-16) 

+ l.9(io---o)>i,...,«/4(/3|0), + a\l)^)■, 

thus if player 1 measures X and the remaining players ex- 
cept player i measure Z, they can push the quantum state onto 
player i's qubit. To push the secret state onto player 1, it is 
enough for the remaining players to measure in the Z basis 
(and of course communicate their result to player 1), as can 
be seen by rewriting the state as 



\Sg)l,...M =a|g(0---0))l,...,n + /?lff(10---0))l,...,n 

^ |m2...m„)2,...,„(a|+)i + ^ 1^2 • • • m„)2,...,„(ah)i + (4.17) 

I 



where rrii is a bit and |m2 . . . mn)2,....n is a product of Pauli 
Z eigenstates. 

We can see this another way, which may give hints of a pos- 
sible way to check accessibility in more general cases. This 
starts from noting that Eq. (14. 14b as having arisen from an- 
other scheme, not teleportation, analogous to the error cor- 
recting schemes in |18i], uniting these approaches. To do 
this the dealer entangles the secret state \S) onto vertex 1 of 
the nGHZM state directly and measures it in the Z basis. By 
making the appropriate correction (based on the measurement 
outcome), the resultant state is that of ( 14. 14b . 

Incidently, we notice that our five party scheme is the same 
graph as the 5 -qubit code in ifisll . which is perhaps not so sur- 
prising, since sharing a threshold scheme for quantum secrets 
is necessarily an error correcting scheme (though not the other 
way round) as pointed out in IMl fTill . Indeed this example ap- 
pears in 10, [Si (although established in a different way). 

Viewing Eq. ( 14.151 ) as having arisen in this way, we can 
imagine the state of the secret qubit entangled to the nGHZM 
state as the start of a measurement based computation with the 
secret qubit as the input. We then choose any one player as an 
output and application of the Flow conditions I17i,il9ll give an 
explicit way to direct the secret onto any one of the players' 
qubits by LOCC. 

We thus have the following proposition. 

Proposition 7. The direct (n, n) scheme can be extended as 
above to give quantum secret sharing schemes with the same 
secrecy access structure. The secret can be localised onto any 
one of the authorized players by LOCC. 



In the (3, 5) threshold case, the dealer starts with the state of 
Fig.[8ja). After teleportation steps ii) and iii) in the protocol, 
the players have the state 

|5'c,)i2345 = a 15(00000)) 12345 + 12345 ■ (4.18) 

Again, the dependency property applied to the states |5(ooooo) ) 
and 15(11111)) for the pentagon graph as in Fig.|6]imply that to 
any two players these states are identical, hence they have no 
dependency on the quantum secret, and so cannot access it. 

The ability for three users to access the secret qubit can be 
seen to follow from the fact that it is also a two qubit erasure 
error correcting scheme ifisll . In general this is not LOCC. We 
can see how this works explicitly writing the state, 

|'5'g)l2345 =a|.9(00000)) 12345 + /3|5(11111) ) 12345 

= l/4(|Boo)l3(«|+)2 + /3|-)2)|Soi)45 
+ |Boi)l3(a|+)2-/3h)2)|Sio)45 
+ |Bio)l3(«|-)2-/3| + )2)|Boo)45 
+ |Sii)i3(ah)2 + /3| + )2)|Sii)45), (4.19) 

where |±) = 1/V2(|0) ± |1)). It is clear that if either pair, 
{vi, V3} or {v4, V5} measure in the Bell basis, they can local- 
ize the quantum secret onto player 2's qubit by telling her the 
result. After the Bell measurements, player 2's qubit will be 
projected into one of four possible states as seen above, which 
can be brought to |5')2 by the appropriate correction operation 
depending on the result (this will consist of a local Hadamard 
and possibly local X and Z flips). Similarly any set of three 
players can localize the secret onto one of their number by two 
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getting together and performing a Bell measure. This leads to 
the following proposition. 

Proposition 8. The direct (3,5) scheme can be extended as 
above to give quantum secret sharing schemes with the same 
secrecy access structure. The secret can be localised onto one 
of the players in an authorized set using quantum channels. 

In 101 it is shown that there can exist no (3,4) QSS scheme 
using pure states - hence it is clear there is no way to extend 
the (3, 4) scheme in this way. This intriguingly coincides with 
the fact that we cannot see how to do a CQ for (3, 4) and may 
indicate a more fundamental connection. 



V. EMBEDDED PROTOCOLS 

We now present an example of an embedded protocol. That 
is, we embed the (n, n) protocols of the previous section into 
a larger graph, taking advantage of the fact that graph states 
are extremely useful for various quantum information tasks. 
The setting we imagine is where a quantum network is en- 
visaged comprising of graph states, and we would like to do 
secret sharing on some sub-network of the total network. This 
may occur as a protocol in its own right or as part of a more 
involved protocol, possibly involving error correction and or 
MBQC. 

We do this via a simple extension of a n-party GHZ states, 
which we call a n-GHZ tree state, depicted in Fig.|9] 

Definition 8. A n-GHZ tree state is any state where there is 
an nOHZM state embedded inside another graph, attached by 
any of the vertices except Vi. 

We now imagine a situation where the dealer hands out this 
state to be shared by the players {vi, . . . , v„} and the rest of 
the network, in this case the neighours A/2, • • • , A/n (which 
may overlap). We then ask, can we still use this state to do the 
secret sharing protocols of the last three sections. We find that 
we can, starting with the following proposition. 

Proposition 9. For all n-GHZ trees of (see Fig. O, the bit 
S — li2 forms an embedded (n, n) direct CC classical secret 
sharing scheme (within the subgroup of players . . . ,v„}j. 
This is true independent of the form of all possible sets of 
neighbours Mi (including overlapping). 

The protocol would run as in the case of Sec. lIV A] with the 
secret being encoded onto the bit S = I12 on the n-GHZ tree. 
The validity of the proposition above can be seen since I12 
can, and only can, be read by all n of the subset of {1, . . . , n} 
players together. This requirement is implied by simple ap- 
plication of the dependency and access properties, which are 
unaffected by the addition of neighbours in this case. How- 
ever, there is a subtlety introduced if the neighbours of one of 
the players may help. 

For example, if a neighbour of player 2, say Vj G A/2, who, 
for simplicity's sake we say only neighbours 2 and no one 
else, the secret S = I12 can be read by the players 

{V1,V3,V4, ..,V„,Vj} 




FIG. 9: (Color online) n-GHZ tree state. A/i represents the neigh- 
bours of qubit V,; (minus vi), and they are allowed to overlap. This 
state gives a (n, n) secret sharing schemes for qubits 1 to n (see 
propositions |9l [To] and II lb . 

since they can measure • K^^j^^ (as it is nontrivial only on 
those players' systems). Thus they can find Zi20Zj2 = S* with- 
out player 2. However, when not allowing for the help of the 
neighbours, and only allowing players in the set {vi, . . . , v„} 
to act together, all n must co-operate to find the secret, hence 
it acts as an (71, n) threshold scheme. 

This would not work for the square (3, 4) or (3, 5) schemes 
since the secret is shared amongst all the players, so attaching 
neighbours to any would spread it out and hence it could not 
be found without measuring the neighbours also, by P2. 

This embedded structure can also be extended to key dis- 
tribution and quantum secret sharing. As in the (n, n) key 
distribution case the total state is made by taking the CC case 
and attaching a vertex to player 1, which is kept by the dealer. 
In the case of the n-GHZ tree state, the total state of dealer, 
players and neighbours is given by 

|5(0))-D.l,...,n,Af2..JV„ 

= (|0)-d|S'(0---0))i,...,«AA2..A^„ 
+ |l)£'l5(10---0))l,...,nA^'2..A/'„) 

= -^(|0 )-D|.9(0---0))l,...,nM..A/'„ 

)D|ff(io...o))l,---,«.^2..AA„)- (5.1) 

The protocol would then run as in Sec. IIVBI using this 
state. As explained above, if players {vi, . . . , v„} work to- 
gether, they can discriminate 

l5(V---0))l---"JV'2..A/'„ 

and 

l5'(10---0))l---."-'V2..AA„ 

because they can measure /c°'^ as they only have support on 
{vi, . . . , v„}. Hence they can access the key. With the dealer 
and the players these measurements correspond to measuring 
stabilizers and K% ■ K° of the total graph (that of Fig.|9] 
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with the dealer attached to vertex 1). Again, from the de- 
pendency arguments PI any subset of {vi, . . . , v„} cannot, 
though again, the same subtleties hold regarding the help of 
the neighbours. 

With regards to security against an eavesdropper, unfortu- 
nately we cannot check all stabilizers in here as we did in 
the (ri, n) case, since the remaining stabilizers have support 
outside qubits {1, . . . , n}. However, we can check that it re- 
mains in a secure subspace, as for the (3, 5) case in Sec. llVBl 

Let h denote the subgraph induced by removing all neigh- 
bouring sets {Mi} from Fig. |9]plus a dealer vertex attached 
to vi (giving the graph as in Fig. |3a)), and |% ^) the asso- 
ciated encoded graph state. If the expectation values of A'p 
and ■ K'^ are both +1 (as can be checked be sacrificing 
part of the sifted key), then we can be sure that the state of the 
dealer and players {vi . . . v„} are in the subspace 

That is, in the subspace such that the first two entries of the 
bit string are zero, and the remaining n — 1 elements are free, 
which we denote with bit string 



(i.e., the subspace spanned by all such bit strings). 

If we now call p the graph after also removing the dealer's 
qubit (i.e. the nGHZM graph), the complete state of the 
dealer, players {vi . . . v„}, and any environment E (including 
the neighbours and possible eavesdropper) can therefore be 



written as 

(5.2) 

where the summation is over the bit string ??^2 Tracing 
out all the players, we have that the state of the dealer and 
the environment is pE ^ 1/2d; thus we see that the mutual 
information between the environment and the dealer is zero. 

Hence, on the condition that the value of /vf and K^, ■ 
i^P are both found to be +1, any environment, including a 
possible eavesdropper, can have no information about the key. 
If the measurement results do not satisfy this condition, they 
should be discarded as in Sec. IIV Bl Thus, we thus have the 
following proposition. 

Proposition 10. For all n-GHZ trees ofn qubits (see Fig. |9l), 
the bit li forms an embedded (n, n) key distribution QC secret 
sharing scheme ( within the subgroup of players { Vi , . . . , v„ } j. 
This is true independent of the form of all possible sets of 
neighbours Afi (including overlapping). 

We can also see how to extend this embedded protocol to 
sharing a quantum secret. As in Sec. IIV CI the dealer uses 
the state of the key distillation protocol, in this case ( 15.1b . to 
teleport the secret qubit onto the player's qubits giving the 
encoded state dealt to the players and their neighbours 



\Sg)l^...,n,N'2--M'^ — "|ff(0---0))l,...,n,7V2,...,n„ + /?|5(10---0)) l,...,n,A/'2,...,n„ 

= Y |"i2 ■ • ■m„)2,...,„|A/',f;,,2>AA2...7V„ (a|+>i + 

m2©---em„=0 

+ ^ |n^2 • ■ •'7l„)2,...,„|AAm,2)A/'2...A/-„ (Q!|-)i + , (5.3) 

m2e---®m„ = l 

I 



with A/" the subgraph of the set ■ ■ ■ A/'„}, 1^7x1,2) ^f2■■■^^n 
the associated encoded graph state, and bit string m^,2 is a 
function of bit values {7712, . . . , m„}. 

From this it is clear that if players {v2, . . . , v„} measure 
in the Z basis, they project the state of player I's qubit onto 
either a|+)i + /3|— )i or a|— )i + /3|+)i if the total parity is 
odd or even respectively. These can be taken to the original 
secret state \S)i by the action of correction operator JJ^"™ — 
Hi for even parity, and Uf^^ = HiZi for odd parity. Again 
the dependency rules used in the CC mean that any less than 
complete set in the set of players vi , . . . , v„ can not access the 
secret. Thus we have the following proposition. 

Proposition 11. For all n-GHZ trees ofn qubits (see Fig. 
the bit li is forms an embedded (n, n) QQ quantum secret 
sharing scheme ( within the subgroup of players { Vi , . . . , v„ } j. 



This is true independent of the form of all possible sets of 
neighbours Mi (including overlapping). 

The QQ is perhaps the most useful of the embedded proto- 
cols as it could readily be seen as part of an extended network, 
for example, the input to our protocol could occur as an out- 
put of some previous MBQC, and the output of our protocol 
could be the input to a subsequent computation. 

VI. CONCLUSIONS 

We have seen that graph states are a good resource giving a 
unified approach to secret sharing of both quantum and classi- 
cal secrets, in the presence of an eavesdropper. The protocols 
presented can be clearly understood from simple properties of 
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classical information on graph states we have showed. In par- 
ticular this gives a new way to generate protocols of address- 
ing the second situation, that of sharing a quantum secret in 
the presence of eavesdropper, beyond (71, n) for the first time. 
Explicilty we have presented the case of a (3, 5) secret shar- 
ing protocol for such a setting. Further we have introduced 
so-called embedded secret sharing protocols as a first step to 
integrated quantum networks. 

A natural question to ask next is how far can these ideas be 
pushed and which (fc, n) can be covered. This then becomes 
a graph theoretic relabeling problem - where the labels are the 
secrets (more precisely the encoding of the secrets), and their 
access given by our rules. We expect that this way will re- 
sult in many cases. However, we know that directly not all 
{k, n) cases can be solved. We can see for example that it is 
impossible to do a (3, 2) direct secret sharing scheme with a 
graph state using our protocol. This can be seen easily, firstly 
by noticing that demanding single individuals get no informa- 
tion means all three must be entangled. Then we have two 
options, either the 3-GHZM, or the fully connected graph. In 
both cases it is easy to see that there is no way to choose an 
encoding of secret S onto the £i2 such that all three pairings 
depend on it simultaneously (thus, they cannot all access it). 
The application of the graphical properties presented to this 
problem is an ongoing area of investigation. 

We can also ask is it possible to extend the protocols in this 
work somehow to cover these cases which currently cause dif- 
ficulty. One such extension may be possible via the connec- 
tion between the sharing of quantum and classical secrets we 
have seen in our protocols. In |01 solutions to the general 
{k, n) sharing of a quantum secret were provided via connec- 
tions made to error correction. 

Although we arrived at our QQ from a different ap- 
proach,not related to error correction, they can be thought of 
as stabilizer codes, so relating to those of 1411, s ince all stabi- 
lizer codes can be thought of as graph codes II18I1 . A benefit of 
our approach is that we have been able to use intuitive graph- 
ical ideas to prove which players can access which informa- 
tion. Perhaps extending to higher dimensional graph states, 
we would be able to recapture the results of 10] for the most 



general case seems likely to be possible for sharing quantum 
secrets. The next step would be to translate this to the key 
distribution protocol, which would be possible via the con- 
nections shown here. 

As we have mentioned, there is also the outstanding ques- 
tions of security for these protocols. Here we have seen se- 
curity against certain classes of attacks, as in HBB lH. The 
question of security for secret sharing is a large problem of 
current interest ||20[ I21I I22I1 . Another problem raised was that 
of noisy channels as it stands our protocol is not resilient to 
noise. This was also a problem for HBB, and it seems likely 
that the same approach used in ifToll can be used to address 
both these problems, that is via connection with entanglement 
distillation. To this end the wealth of results on entanglement 
distillation for graph states 160 will help push this direction 
further 

We hope that this work will enable the integration of differ- 
ent quantum information protocols, for example secret com- 
puting, perhaps the most interesting property of these schemes 
is their integratability. As quantum technologies become more 
accessible in the real world, it is likely that in a real network 
setting we would like to do combinations of tasks, without 
having to change and swap hardware. The embedded proto- 
cols here are a first step towards this goal, and we hope these 
ideas can pave the way for more integrated schemes. 
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